Unknown user name or bad password???

[Richard Darling]

I receive the following message in my event log alot during the day. It always comes from either the one W2K workstation we have on the network; or an NT workstation at our daycare center. Both users tell me that they are logging in once in the AM...what could they be doing to trigger this message:

Event ID # 529
Logon Failure:
Reason:Unknown user name or bad password
User Name:
Domain: PC34
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: PC34

[Paul R. Dittrich]

This URL is a big help:
http://www.eventid.net/events.asp

The bad news is they say that "an unexpected increase" in these messages may possibly indicate a dictionary attack on account passwords.

HTH,
Paul

[Richard Darling]

Thanks for the link Paul...it is a good one.

However, I know that the two workstations that are creating these messages are the only ones that dont't use W95 or W98; one is a W2K and the other is NT. The users are both legit. and are working on the workstations when these events are created...I know it has something to do with their OS...was wondering if anyone els had the same problem, and how they solved it.

[Sanjay_6]

Hi,

I think once it mentions the Workstation name as PC34 you should be able to identify which wkstn is giving you this problem. Also is the domain name PC34 correct or it should be something else, or could be it shd be configured as a workgroup.

Just an idea.

Thanks

[Richard Darling]

Sanjay,
The users are both legit, and are logged in and working on the workstations when these events are created...PC34 is the name of the W2K workstation.

[Kurt Matthies · Accepted solution]

Hi Richard,

What are they connecting to that server for? Could it be mail access? This would cause their workstation to log into the server whenever they make a the connection to check for or send mail.

Could you be experiencing this problem because of a workgroup/domain credential conflict?

I've seen this happen when a user is crossing into a domain boundary for a certain resource, and doesn't have the correct ACL for that domain.

For example, if I'm logged in as Admin on a workstation in the workgroup A, and I try to access the server, which is a PDC of domain B, I'm coming in with my Admin token from the workstation. I get rejected because Admin on the workstation is not the same as Admin on the server, ie, I don't have the proper credentials to be Admin in the domain.

We solve the problem by having a unique login name, say Fred, on the workstations that map to a unique login name, Fred, in the domain.

Hope this helps.

[Susanne Czerny]

Hi,

I had a similar problem the other day, there had been an IP address conflict on an NT server, and since then, when a user on a special NT workstation tried to access that server, he got the error message "Unknown user name or bad password".
I first tried netdom (NT resource kit) and then rebooted the server. No more problems since then.

Technet lists these possible causes for error # 529 :
- Forgotten passwords, someone is entering the wrong password. (not in your case)
- An unauthorized individual is trying to gain access to the network. (as someone has already suggested)
- There is a persistent network connection with an invalid password.
- There is a service using a user account with an invalid password.
- Trust relationship has been broken.

Hope my suggestions helped!
Susanne

[Richard Darling]

Kurt, I changed the password for the local administrator on the PC's in question and no longer receiving the message. It seems odd...does that mean that the local admin on every workstation must have the same password as the domain admin?? There must be a way around this issue...any thoughts out there??
Another scary thought is that the admin account gets locked out on the server if that option is selected for passwords on the domain...
Richard Darling

[Enes Dizdarevic]

It seems that affected workstations have installed a service or com+ application which use security context of user administrator and that configuration of this service or application was not changed when administators password was changed. I recommend checking configuration of all services and com+ application and making appropriate changes.

On Win 2000 you can check konfiguration of services in: administrative tools, computer management, services and applications, services, properties, log on tab. Configuration of Com+ application can be checked using Component Services management console. Select Start, Run and enter mmc. On empty management console select: console, add/remove snap-in, select add and choose Component service. In left pane select each com+ application and check properties, identities tab.

On NT 4.0 workstation you can check services in control panel, services. Com+ applications can be checked using program comcnf.exe (or comcnfg, I do not remember exact name but you can easily find it using find function). When you start it you will get interface similar to component service management console. Check properties, identity tab for each application.

[Kurt Matthies]

Hi Richard,

The Windows NT domain model is a bit obtuse. While it does a good job enforcing security, there are problems if organizations don't develop the proper working protocols, and frankly, sometimes I just have to make it up as I go along.

There is some good information in the Windows NT 4.0 Server resource kit. The book about networking describes the old Microsoft corporate network and will give you insight into how to structure your network, if you are willing to spend the time on an old, outmoded technology. (I understand my certification "expires" at the end of this year, and I'll no longer be a "certified" engineer if I don't take the Win 2000 test, but that's another story).

According to Microsoft, Windows (NT) users are not supposed to log in as Administrator, but as another user with lesser privileges.

In my consulting experience, most clients ignore this warning.

I also find the NT security model difficult to work with, especially in a mixed-domain netowrking environment.

What I've done when I've had to mix Windows NT domains, is to use trust relationships between them for correct authentications to occur.

But I'm sure you will still find inconsistencies that you'll need to work around. If you're a good sysadmin, you'll soon get the feel of how NT does things and stumble into your own solutions and work arounds.

Good luck.

[T Dagg]

This sounds similar to what I'm experiencing on my 'XP'(Home) machine.
Now I don't have half the knowledge that all of you have but this is something I've seen in my Event viewer for some time now.
The funny thing is, if I hadn't seen it in the 'Security' log I don't think I would have known anything was wrong..
My PC isn't networked [at this particular time] (and FYI I recently did a destructive system recovery)after which I did change my logon PW and changed the "Owner'[name] and the PC's 'name'.
Here's a portion of my Security log*:(It's probably more than I need to show/post, but as I said,I don't know half what you folks do,but I'm far from being a 'Novice'):*(Included as an 'attachment)..

One other thing.. Every time (well, quite frequently anyway) I use Norton Systemworks (2002 Pro)'Disk Doctor' it tells me that there's a problem with 'Security Descriptors'...
Could this be [in any way] related to the 'Logon' issue?

[Kevin Bowersock]

the logon type 3 indicated
"A user or computer logged on to this computer from the network" ( from microsoft technet article :
http://www.microsoft.com/technet/archive/winntas/support/usesecur.mspx

I looks like there is a mapped drive perhaps that is causing the issue. If the Workstation users are logging on using the "administrator" account. and then attempt to map a drive to the server it will "hand over" the Administrator account/password. since they exist on both boxes, the server will compare the password with what it has for the local "administrator" account. If they don't match Poof! 529 in the security log.

Hope that makes sense!
Kevin,

[Richard Darling]

This is an old thread...